CVE-2026-87994

creationtimestamp| type| source ---|---|--- 2026-09-10 16:35:10+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-fmqh-xp37-5hr8...

GO-2026-6371 Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision in github.com/semaphoreui/semaphore

Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision in github.com/semaphoreui/semaphore...

CVE-2026-88881

Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP Link header when interacting with GitHub.com, GitHub Enterprise Cloud, or GitHub Enterprise Server, and sends the credentials configured for that host to the URL given as the 'next' page. Becaus...

EUVD-2026-75431

Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP Link header when interacting with GitHub.com, GitHub Enterprise Cloud, or GitHub Enterprise Server, and sends the credentials configured for that host to the URL given as the 'next' page. Becaus...

CVE-2026-88881 Renovate before 44.11.3 Credential Exfiltration via Link Header

Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP Link header when interacting with GitHub.com, GitHub Enterprise Cloud, or GitHub Enterprise Server, and sends the credentials configured for that host to the URL given as the 'next' page. Becaus...

casc-analys

💜 Что такое CASC-ANAYS? CASC-ANAYS — это модульный аналитиче...

Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py

Reporter: Aaron / Aeon — autonomous security agent https://github.com/aaronjmars/aeonProject: omnigent-ai/omnigent v0.1.0 Databricks — meta-harness running Claude Code / Codex / Pi "in check with policies and sandboxing"Component: omnigent/policies/builtins/shell.py shared parser → consumed by...

CVE-2026-13745

A vulnerability in the Gemini CLI prior to version 0.39.1 allows attackers to achieve arbitrary code execution by tricking a victim into starting the CLI within an untrusted directory. The vulnerability is triggered via untrusted .env files overriding GEMINICLIHOME to load malicious configuration...

GHSA-5293-FCM6-FH8V

creationtimestamp| type| source ---|---|--- 2026-09-10 09:00:06+00:00| seen| https://t.me/GithubRedTeam/101902 2026-09-10 23:00:04+00:00| seen| Telegram/IahIDovOHUenK705G5amLwAL2bDi62zGVyXyTFrKtdPZaM 2026-09-11 00:00:09+00:00| published-proof-of-concept|...

CVE-2026-13745 Arbitrary Code Execution in Gemini CLI via Untrusted Local .env Files Overriding GEMINI_CLI_HOME

A vulnerability in the Gemini CLI prior to version 0.39.1 allows attackers to achieve arbitrary code execution by tricking a victim into starting the CLI within an untrusted directory. The vulnerability is triggered via untrusted .env files overriding GEMINICLIHOME to load malicious configuration...

CVE-2026-72815

creationtimestamp| type| source ---|---|--- 2026-09-10 04:00:05+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/101882 2026-09-10 05:00:05+00:00| published-proof-of-concept| Telegram/gOw7ciMZOTUWYNYtqA2ln1nEEiajeumMwU7KLhL3ORvBRlQ 2026-09-11 00:00:52+00:00| published-proof-of-concep...

CVE-2026-18351

creationtimestamp| type| source ---|---|--- 2026-09-10 03:00:32+00:00| seen| https://infosec.exchange/users/offseq/statuses/117244508969713610 2026-09-10 03:00:33+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mv52pwtwai25 2026-09-10 03:40:03+00:00| seen|...

CVE-2026-59160

creationtimestamp| type| source ---|---|--- 2026-09-10 00:35:15+00:00| published-proof-of-concept| https://github.com/DerYeger/yeger/security/advisories/GHSA-2r5q-h53f-9rp3 2026-09-10 04:01:24+00:00| seen| https://gist.github.com/ichintu/d78ea836a25ff89ea1b8a699d08a5b4d 2026-09-15 18:01:51+00:00|...

CVE-2026-56341

creationtimestamp| type| source ---|---|--- 2026-09-10 00:35:09+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-wprj-9cvc-5w37...

CVE-2026-88002

creationtimestamp| type| source ---|---|--- 2026-09-10 00:35:06+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-jqhh-cjmq-vmv6 2026-09-10 02:31:55+00:00| seen| https://gist.github.com/alon710/401536538bb41a7576b21df62b940fb2...

CVE-2026-88001

creationtimestamp| type| source ---|---|--- 2026-09-10 00:35:04+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-5x7x-4c3c-qf5w 2026-09-10 01:32:33+00:00| seen| https://gist.github.com/alon710/855b51c2ea136c7c49beab7d27d1ef40...

PT-2026-89392

Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP Link header when interacting with GitHub.com, GitHub Enterprise Cloud, or GitHub Enterprise Server, and sends the credentials configured for that host to the URL given as the 'next' page. Becaus...

PT-2026-89720

Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0...

PT-2026-89735

CI Branch Name OS Command Injection in @argos-ci/core Summary @argos-ci/[email protected] passes attacker-controlled CI branch/ref strings directly into an execSync template literal in packages/core/src/ci-environment/git.ts:89. When a CI project has hasRemoteContentAccess: false, the Argos upload flow...

CVE-2026-88881: URL Redirection to Untrusted Site

Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP Link header when interacting with GitHub.com, GitHub Enterprise Cloud, or GitHub Enterprise Server, and sends the credentials configured for that host to the URL given as the 'next' page. Becaus...